468edc653bbbcc198bed3febf0f90ea118971dc8828b17ed1d26821a7dce2fc4

General

Target
468edc653bbbcc198bed3febf0f90ea118971dc8828b17ed1d26821a7dce2fc4
Size 794KB
Sample220523-1q112sheb2
SHA256 468edc653bbbcc198bed3febf0f90ea118971dc8828b17ed1d26821a7dce2fc4
MD5 d57f68f38638fa9b5fcc14c1b94a99df
SHA1 c3cf97b7b7b936cdefc8e9060c51e34b41fc21b3
SHA512 ccd6e3bd4316a2ff26d22744ffe4bdc9a06b7caffbdf4f409413f43ec583c2d7365c65c1f7512a35b64682d3e299e8c5231161d5022dd642d7fc3156d8b15387
SSDEEP 12288:nWX/65NYQrwvXQ8kMJ1eCcvgPxr0/J7TVRcbW3u+8ehR+x4STULm7/hNkAHD2J9M:YcNYc8r3o+N29x6424Sd/bkIDvRoFkH
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

468edc653bbbcc198bed3febf0f90ea118971dc8828b17ed1d26821a7dce2fc4

.exe 794KB

468edc653bbbcc198bed3febf0f90ea118971dc8828b17ed1d26821a7dce2fc4

IMPHASH 28bd666374957ad640bfcdff27cdedf7
SHA256 468edc653bbbcc198bed3febf0f90ea118971dc8828b17ed1d26821a7dce2fc4
MD5 d57f68f38638fa9b5fcc14c1b94a99df
SHA1 c3cf97b7b7b936cdefc8e9060c51e34b41fc21b3
SHA512 ccd6e3bd4316a2ff26d22744ffe4bdc9a06b7caffbdf4f409413f43ec583c2d7365c65c1f7512a35b64682d3e299e8c5231161d5022dd642d7fc3156d8b15387
SSDEEP 12288:nWX/65NYQrwvXQ8kMJ1eCcvgPxr0/J7TVRcbW3u+8ehR+x4STULm7/hNkAHD2J9M:YcNYc8r3o+N29x6424Sd/bkIDvRoFkH
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

39872

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize lstrcmpA WriteConsoleInputW TryEnterCriticalSection WritePrivateProfileStructA GetConsoleAliasesLengthW CopyFileExW SetComputerNameExA GetDriveTypeW lstrcpynA GetConsoleAliasExesLengthA FindResourceW BuildCommDCBAndTimeoutsA LoadResource UpdateResourceA InterlockedIncrement _lwrite GetQueuedCompletionStatus VerSetConditionMask MoveFileExW ReadConsoleA InterlockedDecrement ZombifyActCtx WritePrivateProfileSectionA SetDefaultCommConfigW GetSystemWindowsDirectoryW GetNamedPipeHandleStateA GetProfileSectionA SetConsoleScreenBufferSize InterlockedCompareExchange WriteConsoleInputA GetComputerNameW ConnectNamedPipe GetModuleHandleW GetTickCount VirtualFree GetConsoleAliasesLengthA GetDllDirectoryW GetPrivateProfileStringW GetConsoleTitleA ReadConsoleOutputA GetConsoleAliasExesW GetDateFormatA GetCommandLineA CreateActCtxW EnumResourceTypesA SetProcessPriorityBoost GetDriveTypeA GetPriorityClass GetVolumePathNameW GlobalAlloc GetPrivateProfileIntA GetSystemDirectoryW SetFileShortNameW LoadLibraryW IsProcessInJob CopyFileW AssignProcessToJobObject GetCalendarInfoW ReadProcessMemory GetSystemWow64DirectoryW GetSystemWindowsDirectoryA FormatMessageW GetSystemTimeAdjustment GetVersionExW GetFileAttributesA SetConsoleMode GetConsoleAliasW GetWriteWatch VerifyVersionInfoA WriteConsoleW GetBinaryTypeA TerminateProcess GetAtomNameW GetMailslotInfo GetCompressedFileSizeA GetTimeZoneInformation CreateFileW lstrcatA GetOverlappedResult GetACP lstrlenW FindNextVolumeMountPointW CreateMailslotW DeactivateActCtx GetNamedPipeHandleStateW GetConsoleAliasesW ReleaseActCtx SetCurrentDirectoryA GetStartupInfoA GetCPInfoExW FillConsoleOutputCharacterW GetHandleInformation GetLastError GetLongPathNameW ReadConsoleOutputCharacterA CreateNamedPipeA EnumDateFormatsExA CreateTimerQueueTimer WriteProfileSectionA SetComputerNameA VerLanguageNameW GlobalGetAtomNameA DefineDosDeviceA ResetEvent OpenWaitableTimerA GetLocalTime LoadLibraryA UnhandledExceptionFilter InterlockedExchangeAdd SetCalendarInfoW WritePrivateProfileStringA MoveFileA SetConsoleOutputCP GetExitCodeThread AddAtomW GetProfileStringA VirtualLock HeapLock GetCommMask HeapWalk GetTapeParameters FoldStringW SetSystemTime GlobalWire GetModuleFileNameA GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA FindFirstChangeNotificationA lstrcatW FreeEnvironmentStringsW FindNextFileW GetStringTypeW BuildCommDCBA VirtualProtect OutputDebugStringA SetThreadAffinityMask EndUpdateResourceA GetVersionExA GetVersion DeleteFileW GetCurrentProcessId MoveFileWithProgressW GetFileInformationByHandle DebugBreak FindActCtxSectionStringW SuspendThread lstrcpyA SetUnhandledExceptionFilter WideCharToMultiByte DeleteFileA GetStartupInfoW HeapValidate IsBadReadPtr RaiseException Sleep GetProcAddress ExitProcess WriteFile GetStdHandle LeaveCriticalSection EnterCriticalSection SetStdHandle GetFileType GetConsoleCP GetConsoleMode GetCurrentProcess IsDebuggerPresent GetModuleFileNameW GetOEMCP GetCPInfo IsValidCodePage TlsGetValue TlsAlloc TlsSetValue GetCurrentThreadId TlsFree SetLastError SetHandleCount DeleteCriticalSection QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW GetCommandLineW HeapDestroy HeapCreate HeapFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP MultiByteToWideChar SetFilePointer RtlUnwind OutputDebugStringW LCMapStringA LCMapStringW GetStringTypeA GetLocaleInfoA CreateFileA CloseHandle FlushFileBuffers

Name

.text

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

585KB

Virtual Size

840KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xunoh

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yime

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.newizip

Size

512B

Virtual Size

34B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

468edc653bbbcc198bed3febf0f90ea118971dc8828b17ed1d26821a7dce2fc4

kernel32